One solution for this is known from Published International Application WO 2004/013585 A1. In automation technology, especially in process automation technology, field devices are applied, which serve for determining and monitoring process variables. Examples of such field devices are fill level measuring devices, flow measuring devices, analytical measuring devices, pressure and temperature measuring devices, moisture and conductivity measuring devices, density and viscosity measuring devices. The sensors of these field devices register the corresponding process variables, e.g. fill level, flow, pH-value, substance concentration, pressure, temperature, humidity, conductivity, density or viscosity.
The terminology ‘field devices’ includes in connection with the invention, however, also actuators, e.g. valves or pumps, via which, for example, the flow of a liquid in a pipeline or the fill level in a container is changeable. A large number of such field devices are available from members of the company, Endress+Hauser.
As a rule, field devices in modern automation technology plants are connected via communication networks (such as HART multidrop, point to point connection, Profibus, Foundation Fieldbus) with a superordinated unit, e.g. a control system or a control room. The superordinated unit serves for process control, for process visualizing, for process monitoring as well as for start-up and for servicing of the field devices. Supplemental components necessary for operation of fieldbus systems and directly connected to a fieldbus and serving especially for communication with the superordinated unit are likewise frequently referred to as field devices. Examples of these supplemental components include remote I/Os, gateways, linking devices, controllers and wireless adapters.
Depending on application, field devices must satisfy the most varied of safety requirements. In order to satisfy the respective safety requirements, e.g. those of IEC61508 (SIL-standard ‘safety integrity level’), the field devices must be designed redundantly and/or diversely.
“Redundantly” refers to increased safety via two or more different designs of all safety relevant hard- and software components. “Diversely” means that the hardware components, such as e.g. microprocessors, located in the different measuring channels, come from different manufacturers and/or are of a different type. In the case of software-components, diversity requires that the software stored in the microprocessors comes from different sources, e.g. from different manufacturers, respectively different programmers. Through all these measures it should be assured that a safety critical failure of the field device as well as the occurrence of simultaneously arising systematic failures are excluded with high probability as the measured value is being provided.
An example of a safety-relevant application is fill level monitoring in a tank, in which a flammable or also a nonflammable but nevertheless water-endangering liquid is present. In such case, it must be assured that the supply of liquid to the tank is immediately interrupted, as soon as a maximum allowable fill level has been achieved. This, in turn, assumes that the measuring device detects the fill level highly reliably, thus that the measuring device works faultlessly.
While in the case of known solutions the measurement channel is redundantly and/or diversely designed, nevertheless, the evaluation unit, usually a microprocessor, which is designed as a voter, represents the Achilles' heel of a field device. The microprocessor should satisfy the highest safety requirements. The microprocessor is monolithically embodied. If there is in such case a dangerous failure (corresponding to the nomenclature of the above mentioned standards), then the whole field device fails. In order to fulfill the SIL 3 standard, the fraction of dangerous failures to the number of all possible failures must not exceed 1%. This safety level cannot be achieved with a conventional microprocessor.